2ec89041ef
Security:
- Add token-based WebSocket authentication (closes critical security gap)
- In-memory token store with 24h TTL (token_store.py)
- POST /api/auth/token exchanges Basic Auth for WS token
- GET /api/auth/status public endpoint for auth check
- WebSocket validates token query param, rejects with close code 4401
- Frontend LoginPrompt modal for credential entry
- WebSocket manager handles full auth flow with auth_required state
- No-op when AUTH_ENABLED=false (preserves existing behavior)
HTTPS:
- Wire HTTPS toggle in Settings UI (POST /api/system/ssl/toggle)
- Add certificate regeneration button
- Display SSL info (expiration, SANs, SHA256 fingerprint)
Plugins:
- Wire trigger_hook("pm3_command") in PM3 service
- Wire trigger_hook("update_check") in update manager
Build/Infrastructure:
- Enable NetworkManager in pi-gen AP setup stage
- Add HF booster board detection patch for Proxmark3
- Update LED PWM control patch
- Fix BLE adapter, UPS drivers, WiFi manager improvements
- Update HTTPS support stage script
Documentation:
- Update PROJECT_STATUS.md and IMPLEMENTATION_PRIORITIES.md
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
52 lines
1.9 KiB
Python
52 lines
1.9 KiB
Python
"""WebSocket endpoint routes."""
|
|
from fastapi import APIRouter, WebSocket, WebSocketDisconnect
|
|
from .manager import ws_manager
|
|
from ..api.token_store import validate_token
|
|
from .. import config
|
|
|
|
router = APIRouter()
|
|
|
|
|
|
@router.websocket("/events")
|
|
async def websocket_endpoint(websocket: WebSocket):
|
|
"""WebSocket endpoint for real-time event streaming.
|
|
|
|
When AUTH_ENABLED=true, a valid token must be provided as a query
|
|
parameter: ws://host/ws/events?token=<token>
|
|
Tokens are obtained via POST /api/auth/token with Basic Auth.
|
|
Unauthorized connections are closed with code 4401.
|
|
|
|
Events include:
|
|
- connected: Initial connection confirmation
|
|
- system_stats: CPU, memory, temperature updates (every 5s)
|
|
- pm3_devices: Device list on connect/disconnect
|
|
- pm3_status: PM3 connection status changes
|
|
- ups_battery: Battery level updates
|
|
- ups_warning: Low battery warning
|
|
- ups_critical: Critical battery level
|
|
- ups_shutdown: Shutdown initiated
|
|
- ups_config_required: UPS needs configuration
|
|
- update_available: New version available
|
|
- update_downloading: Download progress
|
|
"""
|
|
# Validate auth token when authentication is enabled
|
|
if config.AUTH_ENABLED:
|
|
token = websocket.query_params.get("token")
|
|
if not token or not validate_token(token):
|
|
# Must accept before sending close code so client receives it
|
|
await websocket.accept()
|
|
await websocket.close(code=4401, reason="Authentication required")
|
|
return
|
|
|
|
await ws_manager.connect(websocket)
|
|
try:
|
|
while True:
|
|
# Keep connection alive by waiting for messages or disconnect
|
|
# Client doesn't send data, but we need to detect disconnection
|
|
try:
|
|
await websocket.receive_text()
|
|
except WebSocketDisconnect:
|
|
break
|
|
finally:
|
|
await ws_manager.disconnect(websocket)
|